@backstage/plugin-auth-backend-module-github-provider 0.3.10-next.1 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @backstage/plugin-auth-backend-module-github-provider
 
+## 0.4.1
+
+### Patch Changes
+
+- 5683c85: Bump to latest zod to ensure it has the latest features
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.6.2
+  - @backstage/plugin-auth-node@0.6.12
+
+## 0.4.0
+
+### Minor Changes
+
+- b3286d5: Added the `github.com/user-id` annotation to store GitHub's user ID (immutable) in user entities. Also includes addition of the `userIdMatchingUserEntityAnnotation` sign-in resolver that matches users by the new ID.
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.6.10
+  - @backstage/backend-plugin-api@1.6.0
+
 ## 0.3.10-next.1
 
 ### Patch Changes

package/dist/authenticator.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Strategy as GithubStrategy } from 'passport-github2';\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\n\nconst ACCESS_TOKEN_PREFIX = 'access-token-v2.';\n\n/** @public */\nexport const githubAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    persist: true,\n    required: ['read:user'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const enterpriseInstanceUrl = config\n      .getOptionalString('enterpriseInstanceUrl')\n      ?.replace(/\\/$/, '');\n    const authorizationUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/authorize`\n      : undefined;\n    const tokenUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/access_token`\n      : undefined;\n    const userProfileUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/api/v3/user`\n      : undefined;\n\n    return PassportOAuthAuthenticatorHelper.from(\n      new GithubStrategy(\n        {\n          clientID: clientId,\n          clientSecret: clientSecret,\n          callbackURL: callbackUrl,\n          tokenURL: tokenUrl,\n          userProfileURL: userProfileUrl,\n          authorizationURL: authorizationUrl,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            { fullProfile, params, accessToken },\n            { refreshToken },\n          );\n        },\n      ),\n    );\n  },\n\n  async start(input, helper) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n\n  async authenticate(input, helper) {\n    const { fullProfile, session } = await helper.authenticate(input);\n\n    // If we do not have a real refresh token and we have a non-expiring\n    // access token, then we use that as our refresh token.\n    if (!session.refreshToken && !session.expiresInSeconds) {\n      session.refreshToken = ACCESS_TOKEN_PREFIX + session.accessToken;\n    }\n    return { fullProfile, session };\n  },\n\n  async refresh(input, helper) {\n    // This is the OAuth App flow. A non-expiring access token is stored in the\n    // refresh token cookie. We use that token to fetch the user profile and\n    // refresh the Backstage session when needed.\n    if (input.refreshToken?.startsWith(ACCESS_TOKEN_PREFIX)) {\n      if (!input.scopeAlreadyGranted) {\n        throw new Error(\n          'Refresh failed, session has not been granted the requested scope',\n        );\n      }\n      const accessToken = input.refreshToken.slice(ACCESS_TOKEN_PREFIX.length);\n\n      const fullProfile = await helper\n        .fetchProfile(accessToken)\n        .catch(error => {\n          if (error.oauthError?.statusCode === 401) {\n            throw new Error('Invalid access token');\n          }\n          throw error;\n        });\n\n      return {\n        fullProfile,\n        session: {\n          accessToken,\n          tokenType: 'bearer',\n          scope: input.scope,\n          refreshToken: input.refreshToken,\n          // No expiration\n        },\n      };\n    }\n\n    // This is the App flow, which is close to a standard OAuth refresh flow. It has a\n    // pretty long session expiration, and it also ignores the requested scope, instead\n    // just allowing access to whatever is configured as part of the app installation.\n    return helper.refresh(input);\n  },\n});\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","GithubStrategy"],"mappings":";;;;;AAwBA,MAAM,mBAAA,GAAsB,kBAAA;AAGrB,MAAM,sBAAsBA,uCAAA,CAAyB;AAAA,EAC1D,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,wBAAwB,MAAA,CAC3B,iBAAA,CAAkB,uBAAuB,CAAA,EACxC,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrB,IAAA,MAAM,gBAAA,GAAmB,qBAAA,GACrB,CAAA,EAAG,qBAAqB,CAAA,sBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,QAAA,GAAW,qBAAA,GACb,CAAA,EAAG,qBAAqB,CAAA,yBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,qBAAA,GACnB,CAAA,EAAG,qBAAqB,CAAA,YAAA,CAAA,GACxB,MAAA;AAEJ,IAAA,OAAOA,+CAAA,CAAiC,IAAA;AAAA,MACtC,IAAIC,wBAAA;AAAA,QACF;AAAA,UACE,QAAA,EAAU,QAAA;AAAA,UACV,YAAA;AAAA,UACA,WAAA,EAAa,WAAA;AAAA,UACb,QAAA,EAAU,QAAA;AAAA,UACV,cAAA,EAAgB,cAAA;AAAA,UAChB,gBAAA,EAAkB;AAAA,SACpB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,WAAA,EAAa,MAAA,EAAQ,WAAA,EAAY;AAAA,YACnC,EAAE,YAAA;AAAa,WACjB;AAAA,QACF;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ;AACzB,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CAAa,KAAA,EAAO,MAAA,EAAQ;AAChC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAIhE,IAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,CAAC,QAAQ,gBAAA,EAAkB;AACtD,MAAA,OAAA,CAAQ,YAAA,GAAe,sBAAsB,OAAA,CAAQ,WAAA;AAAA,IACvD;AACA,IAAA,OAAO,EAAE,aAAa,OAAA,EAAQ;AAAA,EAChC,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ;AAI3B,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,UAAA,CAAW,mBAAmB,CAAA,EAAG;AACvD,MAAA,IAAI,CAAC,MAAM,mBAAA,EAAqB;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,YAAA,CAAa,KAAA,CAAM,oBAAoB,MAAM,CAAA;AAEvE,MAAA,MAAM,cAAc,MAAM,MAAA,CACvB,aAAa,WAAW,CAAA,CACxB,MAAM,CAAA,KAAA,KAAS;AACd,QAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,UAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,QACxC;AACA,QAAA,MAAM,KAAA;AAAA,MACR,CAAC,CAAA;AAEH,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,WAAA;AAAA,UACA,SAAA,EAAW,QAAA;AAAA,UACX,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,cAAc,KAAA,CAAM;AAAA;AAAA;AAEtB,OACF;AAAA,IACF;AAKA,IAAA,OAAO,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,EAC7B;AACF,CAAC;;;;"}
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Strategy as GithubStrategy } from 'passport-github2';\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport type GithubProfile = PassportProfile & {\n  nodeId?: string;\n};\n\nconst ACCESS_TOKEN_PREFIX = 'access-token-v2.';\n\n/** @public */\nexport const githubAuthenticator = createOAuthAuthenticator<\n  PassportOAuthAuthenticatorHelper,\n  GithubProfile\n>({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    persist: true,\n    required: ['read:user'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const enterpriseInstanceUrl = config\n      .getOptionalString('enterpriseInstanceUrl')\n      ?.replace(/\\/$/, '');\n    const authorizationUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/authorize`\n      : undefined;\n    const tokenUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/login/oauth/access_token`\n      : undefined;\n    const userProfileUrl = enterpriseInstanceUrl\n      ? `${enterpriseInstanceUrl}/api/v3/user`\n      : undefined;\n\n    return PassportOAuthAuthenticatorHelper.from(\n      new GithubStrategy(\n        {\n          clientID: clientId,\n          clientSecret: clientSecret,\n          callbackURL: callbackUrl,\n          tokenURL: tokenUrl,\n          userProfileURL: userProfileUrl,\n          authorizationURL: authorizationUrl,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            { fullProfile, params, accessToken },\n            { refreshToken },\n          );\n        },\n      ),\n    );\n  },\n\n  async start(input, helper) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n\n  async authenticate(input, helper) {\n    const { fullProfile, session } = await helper.authenticate(input);\n\n    // If we do not have a real refresh token and we have a non-expiring\n    // access token, then we use that as our refresh token.\n    if (!session.refreshToken && !session.expiresInSeconds) {\n      session.refreshToken = ACCESS_TOKEN_PREFIX + session.accessToken;\n    }\n    return { fullProfile: fullProfile as GithubProfile, session };\n  },\n\n  async refresh(input, helper) {\n    // This is the OAuth App flow. A non-expiring access token is stored in the\n    // refresh token cookie. We use that token to fetch the user profile and\n    // refresh the Backstage session when needed.\n    if (input.refreshToken?.startsWith(ACCESS_TOKEN_PREFIX)) {\n      if (!input.scopeAlreadyGranted) {\n        throw new Error(\n          'Refresh failed, session has not been granted the requested scope',\n        );\n      }\n      const accessToken = input.refreshToken.slice(ACCESS_TOKEN_PREFIX.length);\n\n      const fullProfile = await helper\n        .fetchProfile(accessToken)\n        .catch(error => {\n          if (error.oauthError?.statusCode === 401) {\n            throw new Error('Invalid access token');\n          }\n          throw error;\n        });\n\n      return {\n        fullProfile: fullProfile as GithubProfile,\n        session: {\n          accessToken,\n          tokenType: 'bearer',\n          scope: input.scope,\n          refreshToken: input.refreshToken,\n          // No expiration\n        },\n      };\n    }\n\n    // This is the App flow, which is close to a standard OAuth refresh flow. It has a\n    // pretty long session expiration, and it also ignores the requested scope, instead\n    // just allowing access to whatever is configured as part of the app installation.\n    return helper.refresh(input);\n  },\n});\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","GithubStrategy"],"mappings":";;;;;AA6BA,MAAM,mBAAA,GAAsB,kBAAA;AAGrB,MAAM,sBAAsBA,uCAAA,CAGjC;AAAA,EACA,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,IAAA;AAAA,IACT,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,wBAAwB,MAAA,CAC3B,iBAAA,CAAkB,uBAAuB,CAAA,EACxC,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrB,IAAA,MAAM,gBAAA,GAAmB,qBAAA,GACrB,CAAA,EAAG,qBAAqB,CAAA,sBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,QAAA,GAAW,qBAAA,GACb,CAAA,EAAG,qBAAqB,CAAA,yBAAA,CAAA,GACxB,MAAA;AACJ,IAAA,MAAM,cAAA,GAAiB,qBAAA,GACnB,CAAA,EAAG,qBAAqB,CAAA,YAAA,CAAA,GACxB,MAAA;AAEJ,IAAA,OAAOA,+CAAA,CAAiC,IAAA;AAAA,MACtC,IAAIC,wBAAA;AAAA,QACF;AAAA,UACE,QAAA,EAAU,QAAA;AAAA,UACV,YAAA;AAAA,UACA,WAAA,EAAa,WAAA;AAAA,UACb,QAAA,EAAU,QAAA;AAAA,UACV,cAAA,EAAgB,cAAA;AAAA,UAChB,gBAAA,EAAkB;AAAA,SACpB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA,EAAE,WAAA,EAAa,MAAA,EAAQ,WAAA,EAAY;AAAA,YACnC,EAAE,YAAA;AAAa,WACjB;AAAA,QACF;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,KAAA,CAAM,KAAA,EAAO,MAAA,EAAQ;AACzB,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,YAAA,CAAa,KAAA,EAAO,MAAA,EAAQ;AAChC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAIhE,IAAA,IAAI,CAAC,OAAA,CAAQ,YAAA,IAAgB,CAAC,QAAQ,gBAAA,EAAkB;AACtD,MAAA,OAAA,CAAQ,YAAA,GAAe,sBAAsB,OAAA,CAAQ,WAAA;AAAA,IACvD;AACA,IAAA,OAAO,EAAE,aAA2C,OAAA,EAAQ;AAAA,EAC9D,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ;AAI3B,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,UAAA,CAAW,mBAAmB,CAAA,EAAG;AACvD,MAAA,IAAI,CAAC,MAAM,mBAAA,EAAqB;AAC9B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,YAAA,CAAa,KAAA,CAAM,oBAAoB,MAAM,CAAA;AAEvE,MAAA,MAAM,cAAc,MAAM,MAAA,CACvB,aAAa,WAAW,CAAA,CACxB,MAAM,CAAA,KAAA,KAAS;AACd,QAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,UAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,QACxC;AACA,QAAA,MAAM,KAAA;AAAA,MACR,CAAC,CAAA;AAEH,MAAA,OAAO;AAAA,QACL,WAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,WAAA;AAAA,UACA,SAAA,EAAW,QAAA;AAAA,UACX,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,cAAc,KAAA,CAAM;AAAA;AAAA;AAEtB,OACF;AAAA,IACF;AAKA,IAAA,OAAO,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,EAC7B;AACF,CAAC;;;;"}

package/dist/index.d.ts

@@ -3,7 +3,11 @@ import { PassportOAuthAuthenticatorHelper, PassportProfile, OAuthAuthenticatorRe
 import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
 
 /** @public */
-declare const githubAuthenticator: _backstage_plugin_auth_node.OAuthAuthenticator<PassportOAuthAuthenticatorHelper, PassportProfile>;
+type GithubProfile = PassportProfile & {
+    nodeId?: string;
+};
+/** @public */
+declare const githubAuthenticator: _backstage_plugin_auth_node.OAuthAuthenticator<PassportOAuthAuthenticatorHelper, GithubProfile>;
 
 /** @public */
 declare const authModuleGithubProvider: _backstage_backend_plugin_api.BackendFeature;
@@ -17,9 +21,16 @@ declare namespace githubSignInResolvers {
     /**
      * Looks up the user by matching their GitHub username to the entity name.
      */
-    const usernameMatchingUserEntityName: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, {
+    const usernameMatchingUserEntityName: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<GithubProfile>, {
+        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
+    } | undefined>;
+    /**
+     * Looks up the user by matching their GitHub user ID to the github.com/user-id annotation.
+     */
+    const userIdMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<GithubProfile>, {
         dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
     } | undefined>;
 }
 
 export { authModuleGithubProvider as default, githubAuthenticator, githubSignInResolvers };
+export type { GithubProfile };

package/dist/resolvers.cjs.js

@@ -27,5 +27,31 @@ exports.githubSignInResolvers = void 0;
       };
     }
   });
+  githubSignInResolvers2.userIdMatchingUserEntityAnnotation = pluginAuthNode.createSignInResolverFactory(
+    {
+      optionsSchema: zod.z.object({
+        dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+      }).optional(),
+      create(options = {}) {
+        return async (info, ctx) => {
+          const { fullProfile } = info.result;
+          const userId = fullProfile.nodeId;
+          if (!userId) {
+            throw new Error(`GitHub user profile does not contain a user ID`);
+          }
+          return ctx.signInWithCatalogUser(
+            {
+              annotations: {
+                "github.com/user-id": userId
+              }
+            },
+            {
+              dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: userId } } : void 0
+            }
+          );
+        };
+      }
+    }
+  );
 })(exports.githubSignInResolvers || (exports.githubSignInResolvers = {}));
 //# sourceMappingURL=resolvers.cjs.js.map

package/dist/resolvers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { z } from 'zod';\n\n/**\n * Available sign-in resolvers for the GitHub auth provider.\n *\n * @public\n */\nexport namespace githubSignInResolvers {\n  /**\n   * Looks up the user by matching their GitHub username to the entity name.\n   */\n  export const usernameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { fullProfile } = info.result;\n\n        const userId = fullProfile.username;\n        if (!userId) {\n          throw new Error(`GitHub user profile does not contain a username`);\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            entityRef: { name: userId },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["githubSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA6BiBA;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAIE,EAAMA,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,MACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,QAAA,MAAM,SAAS,WAAA,CAAY,QAAA;AAC3B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA;AAAO,WAC5B;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAAA,CAAA,EAnCcF,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;;"}
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\nimport { z } from 'zod';\n\nimport { GithubProfile } from './authenticator';\n\n/**\n * Available sign-in resolvers for the GitHub auth provider.\n *\n * @public\n */\nexport namespace githubSignInResolvers {\n  /**\n   * Looks up the user by matching their GitHub username to the entity name.\n   */\n  export const usernameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n        ctx,\n      ) => {\n        const { fullProfile } = info.result;\n\n        const userId = fullProfile.username;\n        if (!userId) {\n          throw new Error(`GitHub user profile does not contain a username`);\n        }\n\n        return ctx.signInWithCatalogUser(\n          {\n            entityRef: { name: userId },\n          },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: userId } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n\n  /**\n   * Looks up the user by matching their GitHub user ID to the github.com/user-id annotation.\n   */\n  export const userIdMatchingUserEntityAnnotation = createSignInResolverFactory(\n    {\n      optionsSchema: z\n        .object({\n          dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n        })\n        .optional(),\n      create(options = {}) {\n        return async (\n          info: SignInInfo<OAuthAuthenticatorResult<GithubProfile>>,\n          ctx,\n        ) => {\n          const { fullProfile } = info.result;\n\n          const userId = fullProfile.nodeId;\n          if (!userId) {\n            throw new Error(`GitHub user profile does not contain a user ID`);\n          }\n\n          return ctx.signInWithCatalogUser(\n            {\n              annotations: {\n                'github.com/user-id': userId,\n              },\n            },\n            {\n              dangerousEntityRefFallback:\n                options?.dangerouslyAllowSignInWithoutUserInCatalog\n                  ? { entityRef: { name: userId } }\n                  : undefined,\n            },\n          );\n        };\n      },\n    },\n  );\n}\n"],"names":["githubSignInResolvers","createSignInResolverFactory","z"],"mappings":";;;;;AA8BiBA;AAAA,CAAV,CAAUA,sBAAAA,KAAV;AAIE,EAAMA,sBAAAA,CAAA,iCAAiCC,0CAAA,CAA4B;AAAA,IACxE,aAAA,EAAeC,MACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,QAAA,MAAM,SAAS,WAAA,CAAY,QAAA;AAC3B,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,MAAM,CAAA,+CAAA,CAAiD,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,UACT;AAAA,YACE,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA;AAAO,WAC5B;AAAA,UACA;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAKM,EAAMF,uBAAA,kCAAA,GAAqCC,0CAAA;AAAA,IAChD;AAAA,MACE,aAAA,EAAeC,MACZ,MAAA,CAAO;AAAA,QACN,0CAAA,EAA4CA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,OAClE,EACA,QAAA,EAAS;AAAA,MACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,QAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,UAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,MAAA;AAE7B,UAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAC3B,UAAA,IAAI,CAAC,MAAA,EAAQ;AACX,YAAA,MAAM,IAAI,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,UAClE;AAEA,UAAA,OAAO,GAAA,CAAI,qBAAA;AAAA,YACT;AAAA,cACE,WAAA,EAAa;AAAA,gBACX,oBAAA,EAAsB;AAAA;AACxB,aACF;AAAA,YACA;AAAA,cACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,MAAA,EAAO,EAAE,GAC9B;AAAA;AACR,WACF;AAAA,QACF,CAAA;AAAA,MACF;AAAA;AACF,GACF;AAAA,CAAA,EA3EeF,6BAAA,KAAAA,6BAAA,GAAA,EAAA,CAAA,CAAA;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend-module-github-provider",
-  "version": "0.3.10-next.1",
+  "version": "0.4.1",
   "description": "The github-provider backend module for the auth plugin.",
   "backstage": {
     "role": "backend-plugin-module",
@@ -37,17 +37,17 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.6.0-next.1",
-    "@backstage/plugin-auth-node": "0.6.10-next.1",
+    "@backstage/backend-plugin-api": "^1.6.2",
+    "@backstage/plugin-auth-node": "^0.6.12",
     "passport-github2": "^0.1.12",
-    "zod": "^3.22.4"
+    "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.14.0-next.1",
-    "@backstage/backend-test-utils": "1.10.2-next.1",
-    "@backstage/cli": "0.35.0-next.2",
-    "@backstage/plugin-auth-backend": "0.25.7-next.1",
-    "@backstage/types": "1.2.2",
+    "@backstage/backend-defaults": "^0.15.1",
+    "@backstage/backend-test-utils": "^1.10.4",
+    "@backstage/cli": "^0.35.3",
+    "@backstage/plugin-auth-backend": "^0.26.0",
+    "@backstage/types": "^1.2.2",
     "@types/passport-github2": "^1.2.4",
     "supertest": "^7.0.0"
   },